# GPG signing built-in Debian .deb package Registry

**URL:** <https://forum.gitea.com/t/gpg-signing-built-in-debian-deb-package-registry/8263>\
**Category:** Install/Maintain/Configure\
**Created:** [December 11, 2023, 12:16pm UTC](https://forum.gitea.com/t/gpg-signing-built-in-debian-deb-package-registry/8263 "2023-12-11T12:16:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ausserirdischegesund](https://avatars.discourse-cdn.com/v4/letter/a/f14d63/32.png) [@ausserirdischegesund](https://forum.gitea.com/u/ausserirdischegesund)\
**Post date:** [December 11, 2023, 12:16pm UTC](https://forum.gitea.com/t/gpg-signing-built-in-debian-deb-package-registry/8263/1 "2023-12-11T12:16:25Z")

</div>

Hi everybody, first post here:

I want to use the built in .deb repository function, and uploading my first .deb worked just fine.

But: Is there a way to GPG sign the Debian registry/repository, so I don’t get this warning everytime:

```auto
root@pi:~# apt update
Get:1 https://redacted.at/api/packages/ralph/debian bookworm InRelease [1,922 B]
Hit:2 http://ftp.debian.org/debian bookworm InRelease      
Err:1 https://redacted.at/api/packages/ralph/debian bookworm InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY E40426EAA2ECD3C9
Reading package lists... Done
W: GPG error: https://redacted.at/api/packages/ralph/debian bookworm InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY E40426EAA2ECD3C9
E: The repository 'https://redacted.at/api/packages/ralph/debian bookworm InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

```

TIA Ralph

---

<div class="post-metadata">

**Author:** ![jake](https://avatars.discourse-cdn.com/v4/letter/j/f475e1/32.png) [@jake](https://forum.gitea.com/u/jake)\
**Post date:** [December 11, 2023, 6:53pm UTC](https://forum.gitea.com/t/gpg-signing-built-in-debian-deb-package-registry/8263/2 "2023-12-11T18:53:14Z")

</div>

How are you uploading .deb package? Is it just over API or via actions? If actions, can you show script used to generate .deb?

---

<div class="post-metadata">

**Author:** ![ausserirdischegesund](https://avatars.discourse-cdn.com/v4/letter/a/f14d63/32.png) [@ausserirdischegesund](https://forum.gitea.com/u/ausserirdischegesund)\
**Post date:** [December 12, 2023, 12:31pm UTC](https://forum.gitea.com/t/gpg-signing-built-in-debian-deb-package-registry/8263/3 "2023-12-12T12:31:04Z")

</div>

Thanks, Jake for your reply. I uploaded the package via HTTP put according to  
this:

> **[Debian Package Registry | Gitea Documentation](https://docs.gitea.com/next/usage/packages/packages/debian)**
>
> Publish Debian packages for your user or organization.

What I did not realize was, that the Debian package repository/registry has UI in the webinterface, and that there are instructions in this web interface how to add the repository keys. It works fine for me now, after I have found this interface to the registry.

Thanks,  
Ralph

---

<div class="post-metadata">

**Author:** ![retif](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/retif/32/7142_2.png) [@retif](https://forum.gitea.com/u/retif)\
**Post date:** [October 20, 2025, 9:17am UTC](https://forum.gitea.com/t/gpg-signing-built-in-debian-deb-package-registry/8263/4 "2025-10-20T09:17:34Z")

</div>

> [https://docs.gitea.com/next/usage/packages/packages/debian](https://docs.gitea.com/next/usage/packages/packages/debian)

That link leads to 404 now, and the one that seems to be a “live” variant of the previous - [https://docs.gitea.com/usage/packages/debian](https://docs.gitea.com/usage/packages/debian) - does not contain instructions for uploading one’s own PGP key to be used for signing packages. And by default the Debian packages registry uses some auto-generated(?) key, as it seems.

The Gitea’s web GUI also does not provide instructions for setting a custom PGP key for signing `.deb` packages.

It may already be documented somewhere, but unfortunately I couldn’t find it. Can someone please point me to the right place? I’d be totally fine with not having it in the GUI, a bare cURL upload of the `.asc` is no problem for me, but I just don’t know what is the uploading route/URL (_if there is one at all_).

---

<div class="post-metadata">

**Author:** ![retif](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/retif/32/7142_2.png) [@retif](https://forum.gitea.com/u/retif)\
**Post date:** [October 31, 2025, 10:27am UTC](https://forum.gitea.com/t/gpg-signing-built-in-debian-deb-package-registry/8263/5 "2025-10-31T10:27:49Z")

</div>

Found this [GetOrCreateKeyPair()](https://github.com/go-gitea/gitea/blob/ef90befef1dcc40b0b978e2f4ab390c2d5924f00/services/packages/debian/repository.go#L40) function in the sources, which seems to first checking for an existing key before generating a new one:

```go
func GetOrCreateKeyPair(ctx context.Context, ownerID int64) (string, string, error) {
    priv, err := user_model.GetSetting(ctx, ownerID, debian_module.SettingKeyPrivate)
    // ...

```

but I couldn’t figure out where this `GetSetting()` is looking for a key, so I could provide my own before the first ever key-pair generation or so I could replace the already existing key-pair with mine.